CVE-2017-12868

Critical

Published: 01/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp version 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication due to missing character conversions before an XOR operation.

Risk Assessment

Organizations may be exposed to attacks that allow for session hijacking or bypassing authentication mechanisms, potentially leading to unauthorized access to systems.

Recommendation

It is recommended to update SimpleSAMLphp to the latest version and to use PHP version 5.6 or newer to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.